[
https://issues.apache.org/jira/browse/KAFKA-2510?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14733917#comment-14733917
]
Flavio Junqueira commented on KAFKA-2510:
-----------------------------------------
yeah, it is true, my discussion focused on a single broker, but the dbid idea
still works, since brokers would refuse to start if the dbid isn't the one they
are expecting. you have this scenario when all brokers replicating a partition
have been directed to a different directory.
as for controlled shutdown, I think you're referring to shutting down brokers
one by one, changing the configuration of the broker before restarting. I
haven't really thought too much about a rolling upgrade in the context of
kafka, but in general it's a fragile mechanism for changing
configuration/versions in replicated systems.
> Prevent broker from re-replicating / losing data due to disk misconfiguration
> -----------------------------------------------------------------------------
>
> Key: KAFKA-2510
> URL: https://issues.apache.org/jira/browse/KAFKA-2510
> Project: Kafka
> Issue Type: Bug
> Reporter: Gwen Shapira
>
> Currently Kafka assumes that whatever it sees in the data directory is the
> correct state of the data.
> This means that if an admin mistakenly configures Chef to use wrong data
> directory, one of the following can happen:
> 1. The broker will replicate a bunch of partitions and take over the network
> 2. If you did this to enough brokers, you can lose entire topics and
> partitions.
> We have information about existing topics, partitions and their ISR in
> zookeeper.
> We need a mode in which if a broker starts, is in ISR for a partition and
> doesn't have any data or directory for the partition, the broker will issue a
> huge ERROR in the log and refuse to do anything for the partition.
> [~fpj] worked on the problem for ZK and had some ideas on what is required
> here.
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
